Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

NO, this is not a duplicate of How to patch the Heartbleed bug (CVE-2014-0160) in OpenSSL?. So, read on.

I am seeing conflicting information with respect to Ubuntu 12.04:

  1. The Heartbleed page claims Ubuntu 12.04 to be affected and needs to be patched with 1.0.1g
  2. The Ubuntu Security Notice USN-2165-1 claims that version 1.0.1-4ubuntu5.12 for the package libssl1.0.0 should fix the issue on Ubuntu 12.04.

Now I do have these packages installed:

# dpkg -l | grep ssl
ii  libssl1.0.0                      1.0.1-4ubuntu5.10                 SSL shared libraries
ii  openssl                          1.0.1-4ubuntu5.10                 Secure Socket Layer (SSL) binary and related cryptographic tools

# lsb_release  -a | grep -i description
Description:    Ubuntu 12.04.3 LTS

So, If I consider above two points, I am not sure which one is true.

Besides, this Heartbleed test page says that my machine is vulnerable.

Has anyone yet been able to fix this issue successfully on Ubuntu 12.04? If yes, then could you provide me the steps you have taken?

share|improve this question
    
See also launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12 for the fixed version Changelog –  belacq Apr 10 at 0:22
    
shouldn't the openssl version be 1.0.1g which contains the fix for CVE-2014-0160 as per the changelog on OpenSSL.org –  user267456 Apr 10 at 12:25
    
@Greco, correct me if I am wrong. The version 1.0.1g shows up only if it is installed via source. If it installed via the apt-get, it shows 1.0.1-4ubuntu5.12. Please refer: ubuntu.com/usn/usn-2165-1 –  slayedbylucifer Apr 11 at 9:54
    
possible duplicate of How to patch the Heartbleed bug (CVE-2014-0160) in OpenSSL? –  Lucio Apr 21 at 14:01

2 Answers 2

up vote 8 down vote accepted

Why don't you update? If Ubuntu says you need 5.12, and that heartbleed site says you're vulnerable, what's the problem?

I have the following installed, which was updated yesterday or today on my machine.

ii  openssl                                  1.0.1-4ubuntu5.12
share|improve this answer

Ubuntu has released a patch, you just need to update and upgrade.

sudo apt-get update
sudo apt-get upgrade

To check if you have the latest and patched version, run:

openssl version -a

OpenSSL 1.0.1e 11 Feb 2013
built on: Mon Apr  7 20:33:19 UTC 2014
platform: debian-amd64

Check the "built on:" item, it should be build Apr 7.

share|improve this answer
    
+1...thanks for the -a option. It give much more information. All this time I was simply running openssl version. –  slayedbylucifer Apr 9 at 8:28
1  
Your welcome, I learned it yesterday ;) –  Thomas K Apr 9 at 8:31
    
Perfect Answer. Was unsure that I could just use apt-get to do everything. –  foochow Apr 10 at 23:43
    
when i run dpkg, I'm told I have 1.0.1-4ubuntu5.12 of the library - but when I run openssl version -a it reports as OpenSSL 1.0.1 14 Mar 2012 with a build date of Mon Apr 7 20:33:29 UTC 2014 - is it the build date that is important? –  HorusKol Apr 11 at 0:43
    
@HorusKol, your configuration is good. It is same at my end as well and that indeed is a desirable one. So nothing to worry. –  slayedbylucifer Apr 11 at 4:47

protected by Community Apr 11 at 10:03

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.